tegwick
989d5d4f5d
Standard, schema and validator for the founder's admission of one bounded executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE ceiling with least-privilege coverage, blast radius by consumer, named source-pinned checks, revert per mutating step, budget, single use, and the NK-WP-0040 receipt. check-approval verifies a carrier record (Approval Engine or founder SSH signature): aal2 human approver, not the executor, consumed at most once in the window. Examples express the bind split; step 10 is refused as human-intrinsic. 22 tests; make targets; tool index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
67 lines
7.3 KiB
JSON
67 lines
7.3 KiB
JSON
{
|
|
"schema": "netkingdom.security-tools-index.v1",
|
|
"purpose": "One place for any agent (Claude Code, Codex, Grok) or person to find NetKingdom's security tools, what question each answers, how to run it, and whether an agent may run it. Tool availability is not permission (SECURITY-COMPANION.md section 7).",
|
|
"agent_may_run_values": {
|
|
"yes": "offline and read-only; any agent may run it",
|
|
"fixtures-only": "an agent may run it on synthetic fixtures; real inputs are the owner's",
|
|
"no-attended": "needs a person's private input or authority; an agent prepares and the person runs it",
|
|
"no-live": "contacts a live service; only under the owner's admitted procedure"
|
|
},
|
|
"orientation": [
|
|
{"what": "Security rules, operative form", "where": "SECURITY-COMPANION.md"},
|
|
{"what": "Credential and access routing (who owns a credential)", "command": "warden route find \"<need>\" --json", "where": "~/ops-warden"},
|
|
{"what": "Shared security orientation cards", "command": "PYTHONPATH=../emergent-security/src python3 -m emergent_security.knowledge --repositories .. show start --audience generic", "note": "A withheld card means: read its listed sources instead."},
|
|
{"what": "Standards of record", "where": "canon/standards/"},
|
|
{"what": "Upstream security vocabulary and secrets standard", "where": "../security-canon (Mode of Authority, SEC-DSM 1.0.0)"},
|
|
{"what": "Accounts, authority and accountable automation", "where": "canon/standards/service-identity-privilege_v0.1.md"},
|
|
{"what": "Who and what unlocks recovery", "where": "docs/crisis-custody-list.md"}
|
|
],
|
|
"tools": [
|
|
{"id": "bounded-execution-admission", "path": "tools/bounded-execution-admission", "answers": "Is this admission request well-formed and bounded (exact plan digest, window, scope ceiling, blast radius, checks, revert, budget), and does a carrier record admit it, consumed at most once?",
|
|
"run": "make bounded-execution-admission-check", "test": "make bounded-execution-admission-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/bounded-execution-admission_v0.1.md"},
|
|
{"id": "service-identity", "path": "tools/service-identity", "answers": "Do the declared service accounts conform to the identity and privilege standard?",
|
|
"run": "make service-identity-check", "test": "make service-identity-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/service-identity-privilege_v0.1.md"},
|
|
{"id": "rotation-lanes", "path": "tools/rotation-lanes", "answers": "Does every known credential have a rotation lane with blast radius, verification step and owner?",
|
|
"run": "make rotation-lanes-check", "test": "make rotation-lanes-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/credential-management_v0.2.md"},
|
|
{"id": "service-binds", "path": "tools/service-binds", "answers": "Is an LLDAP service bind held in OpenBao and delivered by ESO exactly as its approved CCR says, equal to the live Secret?",
|
|
"run": "python3 tools/service-binds/bind-lane.py setup|verify <lane> --ccr-sha256 <hash> --kubeconfig <path> --receipt <new.json>", "test": "python3 -m pytest tests/test_service_bind_lane.py", "agent_may_run": "no-attended",
|
|
"standard": "canon/standards/credential-management_v0.2.md"},
|
|
{"id": "custody-record", "path": "tools/custody-record", "answers": "Is a platform-root custody record valid, and may a root grant be observed from it?",
|
|
"run": "uv run tools/custody-record/validate.py <record.json>", "test": "make custody-record-test", "agent_may_run": "yes",
|
|
"standard": "docs/adr/ADR-0017-root-grant-custody-and-account-authority.md"},
|
|
{"id": "tenancy-posture", "path": "tools/tenancy-posture", "answers": "Is a tenancy.yaml declaration valid against the tenancy posture standard?",
|
|
"run": "python3 tools/tenancy-posture/validate.py <tenancy.yaml>", "test": "make posture-feedback-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/tenancy-posture_v0.1.md"},
|
|
{"id": "posture-feedback", "path": "tools/posture-feedback", "answers": "Which owner should get which remediation proposal for a posture finding?",
|
|
"run": "make posture-feedback-reference", "test": "make posture-feedback-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/posture-feedback_v0.1.md", "note": "Proposal-only: never writes State Hub or policy."},
|
|
{"id": "iam-profile-conformance", "path": "tools/iam-profile-conformance", "answers": "Does an OIDC issuer conform to the NetKingdom IAM Profile?",
|
|
"run": "see tools/iam-profile-conformance/README.md", "test": "make iam-profile-conformance-test", "agent_may_run": "fixtures-only",
|
|
"standard": "canon/standards/iam-profile_v0.3.md", "note": "A live check needs a freshly minted access token from the issuer's owner."},
|
|
{"id": "playbook-capability-contract", "path": "tools/playbook-capability-contract", "answers": "Is a Railiance playbook capability declaration valid?",
|
|
"run": "see tools/playbook-capability-contract/README.md", "test": "make playbook-contract-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/playbook-capability-contract_v0.1.md"},
|
|
{"id": "security-scenario-composer", "path": "tools/security-scenario-composer", "answers": "Which providers, trust transitions and responsibilities does a security scenario need?",
|
|
"run": "make security-scenario-compose-lightweight", "test": "make security-scenario-composer-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/security-scenario-composition_v0.1.md", "note": "Plan-only; executes nothing."},
|
|
{"id": "security-case-types", "path": "tools/security-case-types", "answers": "Are a SecurityCaseType and a SecurityCase valid?",
|
|
"run": "see tools/security-case-types/README.md", "test": "python3 -m pytest tools/security-case-types/tests", "agent_may_run": "yes",
|
|
"standard": "canon/standards/security-case-types_v0.1.md"},
|
|
{"id": "emission-cadence-profile", "path": "tools/emission-cadence-profile", "answers": "Does an emission-cadence declaration meet the NetKingdom security overlay?",
|
|
"run": "see tools/emission-cadence-profile/README.md", "test": "make emission-cadence-profile-test", "agent_may_run": "yes",
|
|
"standard": "canon/standards/emission-cadence-security-profile_v0.1.md"},
|
|
{"id": "security-bootstrap-console", "path": "tools/security-bootstrap-console", "answers": "Where is the guided security bootstrap, and what is the next safe action?",
|
|
"run": "make security-bootstrap-console", "test": "make security-bootstrap-console-test", "agent_may_run": "fixtures-only",
|
|
"standard": "docs/smooth-bootstrap-guide.md", "note": "Can write an explicit custody-mode approval record; that is the person's act."},
|
|
{"id": "bootstrap-recovery", "path": "tools/bootstrap-recovery", "answers": "Can the identity backup be retrieved and each service restored in isolation?",
|
|
"run": "tools/bootstrap-recovery/run-isolated-*.sh <transfer receipt>", "test": "NK49_RUN_ISOLATED_*_TEST=1 python3 -m pytest tests/test_isolated_*", "agent_may_run": "no-attended",
|
|
"standard": "docs/identity-restore-drill.md", "note": "Needs the backup age key and private test inputs. Agents prepare and test on fixtures; the operator (admin) runs the real stages (standard SI-13)."}
|
|
],
|
|
"not_security_tools": {
|
|
"coordination-frame": "Renders the coordination receiver from staged sources; repository maintenance.",
|
|
"tutorial-verify": "Verifies runbook tutorial packs."
|
|
}
|
|
}
|